t����1B������!�Aѭ�2�A���m,��7�^���p#�Z+�R*B�HREx�|H{����O3����ǡoz��Kؓ��1/T����d���R��z��՟�^�D���kF��lĜnj�M}�#����P��~e�2��b����T�<�O&e���$���,��V�fa��ME�y������� �,Lj8u�2:���m�N�%���� �'�!AU�M�B���(�|�@�z<~B�0aU�ת��^�\����M?q��Z�/�9��љ���x q��'o!�pME���/5�r����\y��塹��v�A����ޏ�����p�K;j�k��sf�>̿Mq�-� Llb��� �c�3�^�M��~���.�?~��3Zs>���J�a[�ULy��*�$���m �����^e����Q���������ġ�� `���re��Ȟ��X��R;�t]W�tX��Lj9��~��'��`LvI�L�4���?��/O�2�E��hv�6"9އu!��Pk j�7dv���l, },�%iw�7�����ws�L������()ݬ���U��cf�5�����R�!҈4���U�������}����ݞ����J��1i���ФLhEw�Ô� �|�-W����Vg��QF3@�.�0'}�����E��tP��%��]͕���7u�+}'�h���ӱn�U�8Mbu�C�'���l2��?�'M�!���A���8 ��z'EZi*ս�m�C����خ�Z _��jvW������!�F��nӣҵuYYBPq���=�$4R ����Qk͛�d���(�H����i�'NKF>]тz��0�I�ta�c$�1/����� A4w�fH�A1����&�Ź��I��})"�i@(��LL:b����YIkZC�C��g��[}��Mr«U�`�ke?������:åt%`&)��[\G&��#�J�E���h�9xP��s�$�?��,�CD��.*�9�{y�H�7 A��Lu�,X�#'Le�i?���X;�x��N�#���5��bM�E�]Wy�a1X��'��Ⱥ��Ъ��rOu��b�)����.W�i����� r����h��Ļ�8�9�k�t}v�8��"%s�.�/A�G��?�#����aS�!=�1��*lsL����saa���`����Z;���=0�Ͽ�ڮ�(�݀��p |/[?�Js�0�V��L �jW��ש�ڷ$%o+V�fł �Ş���A�^�����W��<�VI<XJx��T4L�:j��@ʊ����^o�@��)���`���v4o��7$l' Y��Xy��FS�%R�� �/"�d��f!�������kܞ ��Rbn��Y�|�����[TN�!��N{V�0���T�[�Ӯv��2��[�T�x�0tt���_�V��`o�}bw�� Tܿ'����8�tsT�+d����ˣ��{} � c2M�|�!�Th���X1���n����V;p�lH{������Yj��斕�+6fh�hb� �ս���%ž��˺~ Z^Qw��T��R�p���.��h&˺������(�)q���D��T��@�]��N�KT��ۙ&˘%����R�^[�/,��,�ݧ���r�Y���r���u���F�82yrv��L���>�m�+r��A^f)0L6�ԅ����:"��$ti_������2a���<ӈ+.�_���Pǡ��� y�����*$�L�~B�l�N� �u�1� !�Ji��:J^���hAmqs���M������V�|!MT1�m#"G2�:� A���[��E�~,�9>r�q��}m^"�S#�SR�gf�������3�Z��qr�V/�X��h��t���FuW���u ��fl'��Bw�����d�G�_{�g�6c����\ D����G[�j{����וo��?�t��vH�Wd ��!�VGQ�����Bm�$���#p�����%�Ҧ��oQ �>Q5��� �\������C��(�o��2�v*d��DY����X���Z�@�w�@譢�����H|�fR�����ZW����a��˪���g���ʋ|�RjX���1�? >'ΞN��ҍ�@�N��ă㋨���(yAoc����6'!�fC��`.�%abW��`�:f1���;�Yl�]�Lp3T���2{S���,�)B{�T�v��Pa� �J��X.]�D�Z��C����~�n�-+����n<��*(bl�Q�iu�|����}�"�Ý7��|�K!�l�V��L���j(�����Gw)-}F]�7�n��n��y2��!WK�(�5E�Ӷ��ܞ1q� :�|CW���,�N!� ��}���f#s�����k�������ǃ��V��!�R��EΘ��({�� �A��|J��.p����� @X�W���Ȓ���Y���Sp��z�|<����?Йu�a�Z�n�۽���2�~�t�=me�>�n&W>N�W�h�{�Y] ���ld�����}H][�\� �Ͱ��-4T��1&c4���(W��mA�1� Z�BGi��h��R3�����������L��fK!S-g�s����q�%�� ܼƜ��-<�9D���~�Z5"2`f���=�ә����A�����f����3<x>ß�{T� >Vߤp�\Vh)K��e�*�d�}�h <�%���F��g�6#Iө�KF�4̟����mg�=CJ��j+�a���9ϥfV.�cm���6mcG�6���BJBL7�i\H��kcr��"�q�?��ҰOh���Ǘ.��gY������'�#��k���Z8�x��W_y�E\ӆ��m}'~Y0�����5=�o�9[����}c7��/�I�L�tS�A������N�*i:��<3���F SU����_E�3^#�Z�����j=�A 9g�T�II�d�ϭ�\���ũ=13��ԇ�Op�q���z]D��B3�h���%�����ɠ������V}�cO���}Æ�g lvY�����L`�dX C�ٌ���deX�i� �mz������|��XW5M퓇\�Y���?y��^��_��<�
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win64.MalwareX-gen.24697.14860.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win64.MalwareX-gen.24697.14860.exe
Resource
win10v2004-20240802-en
General
-
Target
SecuriteInfo.com.Win64.MalwareX-gen.24697.14860.exe
-
Size
6.2MB
-
MD5
92ffd2b619edc0df4985b45b88f308fb
-
SHA1
c252f21a00337ba4f62849bdea4c5b61bfb845e6
-
SHA256
f0959211c721df0d3d56cdf27cd75fc58f3de23e6de15e070dc6aa1d007d3e2c
-
SHA512
01a9349a9ab662ba016cc9a9b7cf0cda2b481acc207065a86d96ca9537670af328d61395059aca40bdf620d7062001a8519bf8537be5cc7c87b48fc90e90f850
-
SSDEEP
196608:Oxh8eBj9ID2uw0V+Kg7IJsoRVsIM1WDrRLZ:Or8Ej9IqH0rg7IJZ7L
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SecuriteInfo.com.Win64.MalwareX-gen.24697.14860.exe
Files
-
SecuriteInfo.com.Win64.MalwareX-gen.24697.14860.exe.exe windows:6 windows x64 arch:x64
e6d53cdbe5738a4e052e19ec48e5fd4c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
HeapFree
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetCapture
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
shell32
ShellExecuteW
msvcp140
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
dwmapi
DwmExtendFrameIntoClientArea
urlmon
URLDownloadToFileA
imm32
ImmSetCompositionWindow
normaliz
IdnToAscii
wldap32
ord143
crypt32
CertGetCertificateChain
ws2_32
htons
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
api-ms-win-crt-runtime-l1-1-0
strerror
api-ms-win-crt-stdio-l1-1-0
_read
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-utility-l1-1-0
srand
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-filesystem-l1-1-0
_access
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-time-l1-1-0
_gmtime64
advapi32
OpenProcessToken
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 297KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 462KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ